Re: DSA-1615-1 vs. tracker

[Gerfried Fuchs <rhonda@deb.at>]

* Florian Weimer <fw@deneb.enyo.de> [2008-09-09 11:17:34 CEST]:
> * Gerfried Fuchs:
> >  I guess as I haven't received any feedback about my patch to the
> > Makefile it is fine to commit that? I will try to dig into how to
> > produce outstanding issue pages for volatile and backports next then.
> 
> I think we also need to implement some form of version name mutilation
> because the ~bpo string needs to be dropped for comparison purposes.

 ... or rather the meaning in the comparison for ~bpo (and ~volatile) be
changed to bigger-than-only-null-string - which might get tricky indeed.
Another approach would be parsing the changelogs (which would mean
having to extract them) and look for the changelog entry version that
are meant to fix the problem.

 Both approaches have their benefits (the latter e.g. for making sure a
maintainer doesn't upload a new version based on their own old upload
instead of the security one, losing the security fix) but indeed have
major drawbacks in the sense that it needs quite some code to get them
implemented.

 Just some thoughts,
Rhonda